Analysis

  • max time kernel
    154s
  • max time network
    190s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/10/2022, 00:57

General

  • Target

    58f51cda6ed74e00d69ad14d5bfe0fb236fd63a1a57fa6cd201c011464c627b8.exe

  • Size

    255KB

  • MD5

    a2628f76bab101a4f552f374f87131ca

  • SHA1

    4bff849b5c40258181da377e2206eb3eb914310e

  • SHA256

    58f51cda6ed74e00d69ad14d5bfe0fb236fd63a1a57fa6cd201c011464c627b8

  • SHA512

    c85b308af155cc190bfaef46dc194c4d01be5feab3c003352e6e2fe6fd0658922b65563873d9aa2d71a16f56533e581980fe18bd29534a257f9ed9ecc3d5705e

  • SSDEEP

    3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJN:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIq

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 5 IoCs
  • Disables RegEdit via registry modification 1 IoCs
  • Executes dropped EXE 5 IoCs
  • UPX packed file 23 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Windows security modification 2 TTPs 6 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
  • AutoIT Executable 12 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 20 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\58f51cda6ed74e00d69ad14d5bfe0fb236fd63a1a57fa6cd201c011464c627b8.exe
    "C:\Users\Admin\AppData\Local\Temp\58f51cda6ed74e00d69ad14d5bfe0fb236fd63a1a57fa6cd201c011464c627b8.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:512
    • C:\Windows\SysWOW64\havlfnemlp.exe
      havlfnemlp.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:3360
      • C:\Windows\SysWOW64\vzvzpixt.exe
        C:\Windows\system32\vzvzpixt.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:4532
    • C:\Windows\SysWOW64\kgwqtksqpkdwpvu.exe
      kgwqtksqpkdwpvu.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1348
    • C:\Windows\SysWOW64\vzvzpixt.exe
      vzvzpixt.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4448
    • C:\Windows\SysWOW64\ofcatdpehqksr.exe
      ofcatdpehqksr.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1812
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
      2⤵
      • Drops file in Windows directory
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:1540

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe

    Filesize

    255KB

    MD5

    777e994dcbf7a519ccfce63cfb198567

    SHA1

    799dbbf145545b40c86ee58bd73f61bb4378ce58

    SHA256

    f060c43e0628c1847fafae8344e045b4e5bbaabe5b7cffcb113e4d9a8d263ddb

    SHA512

    3155ebc97434cd1d22b91f4e8bceeb6dc119e50b573edd51ec0b08aaadfd5e57371f38a57b23e25af42218e383686a9cca1e1809cb071290f16f505e3e58602f

  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe

    Filesize

    255KB

    MD5

    db5f85a2a5a3b778ba0093538cf7317b

    SHA1

    81bb7278f0e6f445d078f7d0e7c35b8c469ae499

    SHA256

    9f379308b9ddd1f16205eb12337adf40ba4ee1cc38788d43c5abe3dbaf4d32bd

    SHA512

    b61cdc04ce4b1128c97f2368bb4aeb90f61c62bcea5aa51ce4d0f114028871ae2dd29d3b8a8cf4e33c47b5a1900e9bdbf7c2a829518592df3395245dd589b074

  • C:\Windows\SysWOW64\havlfnemlp.exe

    Filesize

    255KB

    MD5

    a4a62248d460f4b58ce363e09c2fd763

    SHA1

    f9194bef4c14185b67975c387d2d87f642681347

    SHA256

    580f5d5ea3128316913b8a571f08faf0edbc298398e5cd18d6450cb9d29e0540

    SHA512

    0a5419cfe0f5d845f0e3cbdd58f2ed6136cb5e70b329671109d99b6ad363a8caf2819d72b07a835946c9d5e199c9b9adb4ace88cc984abcb84dedf2101f35ed7

  • C:\Windows\SysWOW64\havlfnemlp.exe

    Filesize

    255KB

    MD5

    a4a62248d460f4b58ce363e09c2fd763

    SHA1

    f9194bef4c14185b67975c387d2d87f642681347

    SHA256

    580f5d5ea3128316913b8a571f08faf0edbc298398e5cd18d6450cb9d29e0540

    SHA512

    0a5419cfe0f5d845f0e3cbdd58f2ed6136cb5e70b329671109d99b6ad363a8caf2819d72b07a835946c9d5e199c9b9adb4ace88cc984abcb84dedf2101f35ed7

  • C:\Windows\SysWOW64\kgwqtksqpkdwpvu.exe

    Filesize

    255KB

    MD5

    fcbe384434144816db29533ecef0bc44

    SHA1

    9fc7361f749b71995644c322ff0ed95b1d7dd5b3

    SHA256

    4b07a35a43870b2e308c7a5d0c40ff3fd6ed27d4a83034d4f05008b47e0868e1

    SHA512

    94e0bd4bc75bcd9a43d9d4e029c4a8739932fe8f12a4a0119c2116a33ec3a934b678530fec1f9e017621da8dab44962ad6a214e78394653722115b64022b62d4

  • C:\Windows\SysWOW64\kgwqtksqpkdwpvu.exe

    Filesize

    255KB

    MD5

    fcbe384434144816db29533ecef0bc44

    SHA1

    9fc7361f749b71995644c322ff0ed95b1d7dd5b3

    SHA256

    4b07a35a43870b2e308c7a5d0c40ff3fd6ed27d4a83034d4f05008b47e0868e1

    SHA512

    94e0bd4bc75bcd9a43d9d4e029c4a8739932fe8f12a4a0119c2116a33ec3a934b678530fec1f9e017621da8dab44962ad6a214e78394653722115b64022b62d4

  • C:\Windows\SysWOW64\ofcatdpehqksr.exe

    Filesize

    255KB

    MD5

    2842e2c4e030d72f482e5046eba9323b

    SHA1

    b0b1751c5b81dfcae04d76e45ca88913b32f4180

    SHA256

    f557d0a66da6d90df7ea47b1d702bd7c98322c1f73d868b399f8bddeea5ebca1

    SHA512

    2ea1836a65337909918e9f91c299036570f62f84781622944144c2a3266d6717cc575285dafb416d6fbbfd439146a9872b7514ea9b6e70136caedabe21631b9d

  • C:\Windows\SysWOW64\ofcatdpehqksr.exe

    Filesize

    255KB

    MD5

    2842e2c4e030d72f482e5046eba9323b

    SHA1

    b0b1751c5b81dfcae04d76e45ca88913b32f4180

    SHA256

    f557d0a66da6d90df7ea47b1d702bd7c98322c1f73d868b399f8bddeea5ebca1

    SHA512

    2ea1836a65337909918e9f91c299036570f62f84781622944144c2a3266d6717cc575285dafb416d6fbbfd439146a9872b7514ea9b6e70136caedabe21631b9d

  • C:\Windows\SysWOW64\vzvzpixt.exe

    Filesize

    255KB

    MD5

    b0a6d5eb4f496817505fee40a3b1c77c

    SHA1

    f83a8278d5b237f81a3c7290fbb8541fe70f18ba

    SHA256

    6fe2c2e22222156c6275fcc5d6aeed05750b225d721ccd611d9c73bb6ee40794

    SHA512

    f41edea587d40ffc25bfc406cf6d9a85ba08c41d482a0ddd7f33db57deb99f73da9a9a353d605806e9834e4544cf1f706f6725ca9b1ef3c1dedf9d4dfd647035

  • C:\Windows\SysWOW64\vzvzpixt.exe

    Filesize

    255KB

    MD5

    b0a6d5eb4f496817505fee40a3b1c77c

    SHA1

    f83a8278d5b237f81a3c7290fbb8541fe70f18ba

    SHA256

    6fe2c2e22222156c6275fcc5d6aeed05750b225d721ccd611d9c73bb6ee40794

    SHA512

    f41edea587d40ffc25bfc406cf6d9a85ba08c41d482a0ddd7f33db57deb99f73da9a9a353d605806e9834e4544cf1f706f6725ca9b1ef3c1dedf9d4dfd647035

  • C:\Windows\SysWOW64\vzvzpixt.exe

    Filesize

    255KB

    MD5

    b0a6d5eb4f496817505fee40a3b1c77c

    SHA1

    f83a8278d5b237f81a3c7290fbb8541fe70f18ba

    SHA256

    6fe2c2e22222156c6275fcc5d6aeed05750b225d721ccd611d9c73bb6ee40794

    SHA512

    f41edea587d40ffc25bfc406cf6d9a85ba08c41d482a0ddd7f33db57deb99f73da9a9a353d605806e9834e4544cf1f706f6725ca9b1ef3c1dedf9d4dfd647035

  • C:\Windows\mydoc.rtf

    Filesize

    223B

    MD5

    06604e5941c126e2e7be02c5cd9f62ec

    SHA1

    4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

    SHA256

    85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

    SHA512

    803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

  • memory/512-149-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/512-157-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/512-132-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/1348-150-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/1348-146-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/1540-158-0x00007FF811CF0000-0x00007FF811D00000-memory.dmp

    Filesize

    64KB

  • memory/1540-166-0x00007FF80F3E0000-0x00007FF80F3F0000-memory.dmp

    Filesize

    64KB

  • memory/1540-165-0x00007FF80F3E0000-0x00007FF80F3F0000-memory.dmp

    Filesize

    64KB

  • memory/1540-159-0x00007FF811CF0000-0x00007FF811D00000-memory.dmp

    Filesize

    64KB

  • memory/1540-160-0x00007FF811CF0000-0x00007FF811D00000-memory.dmp

    Filesize

    64KB

  • memory/1540-161-0x00007FF811CF0000-0x00007FF811D00000-memory.dmp

    Filesize

    64KB

  • memory/1540-162-0x00007FF811CF0000-0x00007FF811D00000-memory.dmp

    Filesize

    64KB

  • memory/1812-152-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/1812-148-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/3360-136-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/4448-147-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/4448-151-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/4532-155-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/4532-167-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB